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We discuss a quantum key distribution scheme in which small phase and 
£NJ \ amplitude modulations of quantum limited, CW light beams carry the key 

\ information. We identify universal constraints on the level of shared informa- 

tion between the intended receiver (Bob) and any eavesdropper (Eve) and use 
this to make a general evaluation of the security and efficiency of the scheme. 
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INTRODUCTION 

The distribution of random number keys for cryptographic purposes can be made secure 
by using the fundamental properties of quantum mechanics to ensure that any interception 
of the key information can be detected. This was first discussed for discrete systems in Refs. 
Experimental demonstrations have been carried out using low photon number, optical 
£j | sources H||. 

The basic mechanism used in quantum cryptographic schemes is the fact that the act 
of measurement in quantum mechanics inevitably disturbs the system. This measurement 
back-action exists for both discrete and continuous quantum mechanical variables. Thus it is 
natural to ask if quantum cryptographic schemes based on continuous variables are possible. 
There are a number of practical disadvantages with discrete quantum cryptographic schemes, 
mainly associated with the lack of true single photon sources. Also it is of fundamental 
interest to quantum information research to investigate links between discrete variable, single 
photon phenomena and continuous variable, multi-photon effects. This has motivated a 
consideration of quantum cryptographic schemes using multi-photon light modes |6|-|13[. 



Most of these schemes use squeezed light |L4| in their protocols, either by producing 
entanglement from the squeezing |10],|8]j9[] or using the squeezing directly In contrast 

to these, one scheme discussed in Ref. || is based on a coherent state. The signals from 
which the key material is obtained are encoded in various ways in the different schemes. 

The question of optimum protocols and eavesdropper strategies has been studied in detail 



for the single quanta case leading to general proofs of security for discrete systems 



T6| , [T7|] . A general proof of the optimum eavesdropper strategy for a simple continuous 



variable scheme was presented in Ref. |TTJ . A general proof of absolute security for a more 



sophisticated scheme was presented in Ref. [|TT 
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In this chapter we will analyse in some detail quantum key distribution protocols based 
on the optical coherent state and squeezed state schemes introduced in Refs. HBliTOf. Our 
emphasis will be on specific implementations that Alice and Bob might use rather than 
general limits. The particular implementations have been chosen mostly for their simplicity 
rather than their optimality. Eve on the other hand is always assumed to be employing 
the optimum eavesdropping strategies allowed by quantum physics fill . We estimate the 
efficiency of the two schemes and hence secure key transmission rates under conditions of 
negligible and non-negligible losses. 

In Section I we review the encoding of information on light with small amplitude and 
phase modulations and introduce a particular encoding scheme. In Section II we find the 
minimum disturbance that an optimum eavesdropping scheme will introduce. The coherent 
state cryptographic scheme is introduced in Section III and the minimum error rates that 
an optimum Eve will introduce are calculated. In Section IV the concepts of mutual infor- 
mation, data reconciliation and privacy amplification are introduced and specific examples 
are applied to the coherent state scheme. The security and efficiency of the scheme are eval- 
uated. The squeezed state cryptographic scheme is introduced, analysed and evaluated in 
Section V. In section VI we discuss a physical implementation of the optimal eavesdropper 
strategy and we conclude in Section VII. 



I. ENCODING INFORMATION WITH SMALL AMPLITUDE AND PHASE 

MODULATIONS 

One way of encoding information on a light beam is by imposing small modulations of 
the phase or amplitude of the beam at some radio frequency (rf) with respect to the main 
optical frequency. We suppose that these signals are imposed at an rf sufficiently large that 
technical noise can be ignored and so our measurement precision is limited only by quantum 
noise. Typically frequencies in excess of about a MHz will suffice. That quantum mechanics 
must impose limits in this situation is because the amplitude and and phase quadrature 
amplitudes of the beam are the analogues of position and momentum variables. Hence they 
are continuous, non-commuting variables that exhibit uncertainty relations. 

We can represent our light field via 

a(t) = a + 5a(t) + 5s(t) (1) 

where a is a bosonic annihilation operator which we have decomposed into a steady state 
part, the coherent amplitude, a, treated classically, and two time varying parts: the quantum 
fluctuations, modelled by the operator 5a(t); and the classical modulation, modelled by 
5s(t). If we take the phase of a real then the amplitude fluctuations, X + , and the phase 
fluctuations, X~, are given by 

X+ = 5a(ty + 8s(t)* + 5a(t) + Ss(t) 

X- = i(5a(tf + 5s(t)* - 5a(t) - 5s(t)) (2) 

Homodyne detection using a local oscillator with a coherent amplitude much larger than 
that of the signal beam can be used to measure the fluctuations. Spectral analysis then 
extracts the fluctuation power at a particular rf, u, such that 
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v+M=<|x + | 2 >=k + + K + (3) 

and 

V-(uj)=<\X-\ 2 >=V- + V- (4) 

where (V~) is the amplitude (phase) quantum noise power whilst V, + (V~) is the am- 
plitude (phase) signal power. The tilde indicates a Fourier transform. 

The amount of information that can be carried on a Gaussian, additive noise, communi- 



cation channel, such as we will consider here, depends on the signal to noise ||19|| . For a fixed 
bandwidth, any reduction in the signal to noise will inevitably lead to increased errors in the 
transmission. In our cryptographic scheme signals will be encoded on both quadratures but 
read out from only one, randomly chosen. This will force any eavesdroppers to monitor both 
the amplitude and phase quadratures simultaneously. For these non-commuting observables 
the information that can be obtained in this way is strictly limited by the generalized un- 
certainty principle for simultaneous measurements pO|,^TJ. We will discuss this principle in 
detail in the next section. Here let us consider a simple example. Suppose we try to observe 
both quadratures by dividing the beam in two at a 50:50 beamsplitter and detecting the 
amplitude quadrature of one beam and the phase quadrature of the other. Originally the 
signal to noises are given by 

(S/N)± = 2£ (5) 

However the signal to noises detected after the beamsplitter are 

(S/N)f im = ( ± )S/N± = T±S/N± (6) 

where we define T + (T~), the amplitude (phase) signal transfer coefficient, as the ratio 
of signal to noise out to signal to noise in. The quantum noise which is inevitably added 
through the empty beamsplitter port is Vj£- The spectral powers are normalized to the 
quantum noise limit (QNL) such that a coherent beam has = 1. Normally the partition 
noise will also be at this limit (V^ = 1). For a classical light field, i.e. where » 1 the 
penalty will be negligible. However for a coherent beam a halving of the signal to noise for 
both quadratures is unavoidable. 

To continue our analysis of this example let us consider the specific encoding scheme 
of binary pulse code modulation. The data is encoded as a train of pulses, a pulse on 
representing pulse off representing a "0". For bandwidth limited transmission the 

bit error rate or error probability (£>) and the signal to noise (S/N) are related by |22| 



B= \ erfc M\ s,N (?) 

Now suppose our signal to noise is initially 13 dB. From Eq.|7] direct detection of a single 
quadrature will retrieve its pulse train with a bit error rate of 1%. If the beam is in a 
coherent state and we simultaneously detect both quadratures then Eq.|6| tells us that the 
signal to noise is halved. Eq.7 then predicts the error rate will rise to 5%. 
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II. OPTIMUM EAVESDROPPER STRATEGY 



In this section we will use the generalized uncertainty principle to identify the minimum 
disturbance allowed by quantum mechanics to the information Bob receives given a particu- 
lar level of interception by Eve. The idea is shown schematically in Fig.l. A single quantum 
limited beam is sent from Alice to Bob. Eve makes some unspecified interception of the 
beam enroute. Bob and Eve obtain some measurement results. We will show that quantum 
mechanics sets unambiguous limits on the level of quantum noise that must appear in Bob 
and Eve's results. In the following sections we will apply these results to specific quantum 
cryptographic systems. 

A more general statement of the generalized uncertainty principle |H] requires that for 
any simultaneous measurements of conjugate quadrature amplitudes 

V^V M > 1 (8) 

where are the measurement penalties for the amplitude (+) and phase (— ) quadratures, 
normalized to the amplification gain between the system observables and the measuring ap- 
paratus. For example suppose an attempt to measure the amplitude quadrature variance of 
a system V fc + returned the result G\V^ + G^K™ where represents noise. Then we would 
have Vm = {G2/Gi)V+- Eq|] follows directly from Eq.|| for ideal simultaneous measure- 
ments. Let us investigate what general restrictions this places on the information that Eve 
can intercept and the subsequent corruption of Bob's signal. Firstly Eve's measurements 
will inevitably carry measurement penalties constrained by 

V£V£ > 1 (9) 

Now suppose Bob makes an ideal (no noise added) amplitude measurement on the beam 
he receives. In order to satisfy Eq.^| it must be true that the noise penalty carried on the 
amplitude quadrature of this beam Vg due to Eve's intervention, is sufficiently large such 
that 

V$V£ > 1 (10) 

Similarly, Bob can also choose to make ideal measurements of the phase quadrature so we 
must also have 

V£V£ > 1 (11) 

Eqs.p|, p!0| , pJ] set strict quantum mechanical limits on the minimum disturbance Eve can cause 
to Bob's information given a particular maximum quality of the information she receives. 
This applies regardless of the method she uses to eavesdrop. Note that quantum memory 
does not negate the above results provided we insist that Alice and Bob do not exchange 
any potentially revealing classical information until Alice is sure that Bob has received and 
measured her signals. 

These relations could form the basis of a security analysis of any continuous variable 
quantum cryptographic scheme in which a single quantum beam is exchanged. However 
the ramifications of a particular level of disturbance will vary for different schemes. In the 
following section we will analyse the security of a very simple scheme based on the exchange 
of a beam in a coherent state. 
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III. COHERENT STATE QUANTUM CRYPTOGRAPHY 



Consider the set up depicted in Fig.2. A possible protocol is as follows. Alice generates 
two independent random strings of numbers and encodes one on the phase quadrature, and 
the other on the amplitude quadrature of a bright coherent beam. The amplitude and phase 
signals are imposed at the same frequency with equal power. Bob uses homodyne detection 
to detect either the amplitude or phase quadrature of the beam when he receives it. He 
swaps randomly which quadrature he detects. On a public line Bob then tells Alice at 
which quadrature he was looking, at any particular time. They pick some subset of Bob's 
data to be the test and the rest to be the key. For example, they may pick the amplitude 
quadrature as the test signal. They would then compare results for the times that Bob 
was looking at the amplitude quadrature. If Bob's results agreed with what Alice sent, to 
within some acceptable error rate, they would consider the transmission secure. They would 
then use the undisclosed phase quadrature signals, sent whilst Bob was observing the phase 
quadrature, to create their key. By randomly swapping which quadrature is key and which 
is test throughout the data comparison an increased error rate on either quadrature will 
immediately be obvious. 

Before making a general analysis of security let us first consider some specific strategies 
an eavesdropper could adopt. Eve could guess which quadrature Bob is going to measure 
and measure it herself. She could then reproduce the digital signal of that quadrature and 
impress it on another coherent beam which she would send on to Bob. She would learn 
nothing about the other quadrature through her measurement and would have to guess her 
own random string of numbers to place on it. When Eve guesses the right quadrature to 
measure Bob and Alice will be none the wiser, however, on average 50% of the time Eve 
will guess wrong. Then Bob will receive a random string from Eve unrelated to the one 
sent by Alice. These will agree only 50% of the time. Thus Bob and Alice would see a 
25% bit error rate in the test transmission if Eve was using this strategy. This is analogous 
to the result for single quanta schemes in which this type of strategy is the most readily 
available. Another single measurement strategy Eve could use is to do homodyne detection 
at a quadrature angle half-way between phase and amplitude. This fails because the signals 
become mixed. Thus Eve can tell when both signals are or both are 1 but she cannot tell 
the difference between 1,0 and 0,1. This again leads to a 25% bit error rate. 

However, for bright beams it is possible to make simultaneous measurements of the 
quadratures, with the caveat that there will be some loss of information. So a second 
strategy that Eve could follow would be to split the beam in half, measure both quadratures 
and impose the information obtained on the respective quadratures of another coherent beam 
which she sends to Bob. How well will this strategy work? We performed this calculation 
at the end of section I using Eq.[7]. The halving of signal to noise imposed by the 50:50 
beamsplitter means the information Eve intercepts and subsequently passes on to Bob will 
have an error probability of 5% (for the particular case of bandwidth limited binary pulse 
code modulation). This is clearly a superior strategy and would be less easily detected. 
Further more Eve could adopt a third strategy of only intercepting a small amount of the 
beam and doing simultaneous detection on it. For example, by intercepting 16% of the 
beam, Eve could gain information about both quadratures with an error rate of 25% whilst 
Bob and Alice would observe only a small increase of their error rate to 1.7%. In other 
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words Eve could obtain about the same amount of information about the key that she could 
obtain using the "guessing" strategy, whilst being more difficult to detect. 

Now let us analyze this coherent state scheme using Eqs.y,[l(],|ll]. We choose to couch 



our evaluation in terms of bit error rates because they represent an unambiguous, directly 
observable measure of the extent to which Eve can intercept information and the resulting 
corruption of Bob's information. This connection will be developed in Section IV. Depending 
on the particular technique Eve uses Bob and Alice may be able to gain additional evidence 
for Eve's presence by comparing the absolute noise levels of the sent and received signals. 
This can only increase the security of the system. By considering a general limit on error 
rates we can find a minimum guaranteed security against eavesdropping regardless of the 
technique Eve employs. 

The signal transfer coefficients for Bob and Eve will be given by 
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Substituting Eqs.|l2] into Eqs.|9| JT0|JTT| and using the fact that = 1 we find 



n+T E <i 

T+ + T B <1 

n + T E <l (13) 

Eqs.[L3] clearly show that any attempt by Eve to get a good signal to noise on one quadrature 
(e.g. Tg — > 1) results not only in a poor signal to noise in her information of the other 
quadrature (e.g. T E — > 0) but also a poor signal to noise for Bob on that quadrature (e.g. 
Tg — > 0), making her presence obvious. This is the general limit of the guessing strategy 
presented in the last section and leads to the same error rates. 

Because of the symmetry of Bob's readout technique Eve's best approach is a symmetric 
attack on both quadratures. Eqs.O then reduces to two equations 



7f + T±<l (14) 

If Eve extracts her maximum allowable signal to noise transfer, T E = 0.5, then ideally 
Bob suffers the same penalty T B =0.5. This is the general limit of the second strategy of 
the previous section. The same reduction in Bob's signal to noise occurs as in the specific 
implementation thus this implementation can be identified as an optimum eavesdropper 
strategy for obtaining maximum simultaneous information about both quadratures. 

Eve's best strategy is to intercept only as much information as she can without being 
detected. The system will be secure if that level of information can be made negligible. 



2T§ < 1 
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Suppose, as in the last section, Eve only intercepts a signal transfer of T§ = .08. From Eq.|T4] 
this means Bob can receive at most a signal transfer of Tg = .92. This is greater than the 
result for the specific implementation discussed in the last section, thus that implementation 
is not an optimum eavesdropper strategy. Using the optimum eavesdropper strategy the 
error rates for the specific encoding scheme discussed in the last section will be: if Eve 
intercepts information with an error probability of 25%, then the minimum error rate in 
Bob's information will be 1.4%. 

In Fig. 3 we represent the general situation by plotting the minimum error rate Bob and 
Alice can observe against the error rate in Eve's intercepted information. An error rate of 
50% (i.e. completely random) represents no information about the data. Two traces are 
shown, representing different initial signal to noises in Alice's data. This graph shows that 
in principle any incursion by Eve will result in some increase in Bob and Alice's error rate. 
However one could also argue that any finite resolution in Bob and Alice's determination of 
their error rate will allow Eve to do better than the random result. In order to assess whether 
this system can be made secure we need to introduce the concepts of mutual information 
and privacy amplification. 

IV. MUTUAL INFORMATION AND PRIVACY AMPLIFICATION 

The mutual information of party 1 and party 2 is the information overlap between the 
data possessed by the two parties. The binary entropy of party l's data, x, is given by 

H(x) = -p x log 2 p x - (1 - p x )log 2 (l - p x ) (15) 

where p x and 1 — p x are the probabilities of the two outcomes. Similarly party 2's data, y, 
has binary entropy 

H(y) = -Pylog 2 p y - (1 - p y )log 2 (l - p y ) (16) 

The joint entropy of the two data strings is then given by 

H(x,y) = -Y, Xty p Xjy log 2 p x ,y (17) 

with p x ^ y the joint probabilities. The mutual information is defined 

H(x:y) = H(x) + H(y)-H{x,y) (18) 

If the two data strings x and y are random then H(x) = H(y) = 1. Suppose the error 
probability between the data strings is B, then the joint probabilities are given by po,o = 
Pi t i — 1 — B and po,i = Pi,o = B. Thus we find 

H(x:y) = l + Blog 2 B + (1 - B)log 2 {\ - B) (19) 

Suppose A is Alice's data string, B is Bob's data string and E is Eve's data string. Maurer 
has shown that provided H(A : B) > H(A : E) then it is in principle possible for Alice 
and Bob to extract a secret key from the data. Eve's mutual information with this secret 
key can be made arbitrarily small. From Eq.|l9| we see that this condition will be satisfied 
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provided Bob's error rate is less than Eve's. From Fig.3 we see that provided Alice and Bob's 
error rate does not exceed 5% for case (a) or 12% for case (b) then secret key generation is 
in principle possible. In the following we will look at a simple specific example of a secret 
key generation protocol and evaluate its efficiency 

Because of the transmission errors (and possibly the actions of Eve) Alice and Bob won't 
share the same data string. However techniques exist for data reconciliation which allow 
Alice and Bob to select with high probability a subset of their data which is error free, whilst 
giving Eve minimal extra knowledge. As a simple example Alice and Bob could perform 
a parity check on randomly chosen pairs of bits. If the error rate between Bob and Alice 
is low then the probability of both bits being wrong is very low. Thus discarding all pairs 
which fail the parity check will lead to a big reduction in errors in the shared data whilst 
not revealing the values of the individual bits to Eve. A series of parity checks will lead with 
high probability to zero errors. Eve can also remove the pairs that Bob removes and in a 
worse case scenario may remove up to the same number of errors as Bob. But if Eve initially 
had significantly more errors than Bob then she will still have significant errors after the 
reconciliation, whilst Bob and Alice will have virtually none. The data string length will be 
reduced by a factor of approximately 1 — 2Bb, where Bb is Bob's error probability. 

In order to reduce Eve's mutual information to a negligible amount the technique of 
privacy amplification is employed p^ ]. This involves the random hashing or block coding of 



the reconciled key into a shorter key. As a simple example Alice and Bob could randomly 
pick data strings of length n from the reconciled key and form a new key from the sum, 
modulo 2, of each n unit block. It is important that the privacy amplification is "orthogonal" 
to the reconciliation protocol. That is none of the pairs used in the parity checks should 
appear together in the privacy amplification blocks. The length of the new key will be 
reduced by a factor of 1/n. The error probability in the new key will be given by 

^^ W M> "-^ (20) 

where B is the error probability of the original string. If B ~ 0, as for Bob and Alice, then 
this process introduces virtually no errors. But when Eve copies this process her errors will 
be "amplified", hopefully to the point where her mutual information is negligible. Some 
caution is required in evaluating Eve's mutual information now. Just as Bob and Alice were 
able to select a sub-set of results they knew were correct in the reconciliation process, so 
Eve can also obtain a (smaller) subset of results for which she has greater confidence. We 
make the worst case assumption that after privacy amplification Eve is left with some small 
probability, p r , of possessing certain bits that she knows are right, and a large probability, 
1 — p r , of possessing bits which are completely random. In such a situation it is appropriate 
to set Eve's mutual information as 

H(A : E) = Pr = 1 - 2B pae (21) 

where B pae is Eve's average error probability, as given by Eq.[20|. 

Let us now apply these techniques to the continuous variable protocol of the previous 
section to evaluate its security. After Bob has received all the data from Alice he tells her 
at which quadrature he was looking at any particular time and Alice sorts out her sent data 
accordingly. They then compare a randomly chosen sub-section of their data (approximately 
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half) and determine the error rate. For the example in the previous section they expect a 
base error rate of 1%. Let them reject the data and start again if they detect an error rate 
of > 2%. To be cautious, let us assume that in fact the error rate could have been as high as 
2.5%. For sufficiently long data strings there will be negligible probability of this error rate 
being exceeded in the undisclosed data From Fig. 3 (trace (a)) we can read off that Eve's 
error rate must be >10.5%. Applying our simple information reconciliation protocol Bob 
and Alice's error probability can be reduced to virtually zero whilst Eve's error rate is >8%. 
We now apply privacy amplification. Fig. 4 (trace (a)) shows Eve's mutual information as a 
function of the block length, n. Clearly Eve's mutual information is decreasing exponentially 
as a function of block length. This is the signature of a secure system. A linear expenditure 
of resources results in an exponentially small mutual information with Eve. In fact Bob and 
Alice can do better by using a smaller initial signal strength. If Alice reduces the size of the 
signal she sends to about half that of the previous example (now with a signal to noise of 
about lOdB) Bob's base error rate will rise to 5%. They set their error threshold at 6%. To 
be cautious we assume the error rate could be as high as 6.5%. From Fig.3 (trace (b)) we 
find that Eve's error rate must be >26%. After reconciliation Eve's error rate must still be 
>19.5%. Fig.4 (trace(b)) plots Eve's mutual information as a function of the block length 
for this situation showing a more rapid decay. This is approximately the optimum signal 
strength. However Alice and Bob may also seek to improve the efficiency of the system by 
employing more sophisticated reconciliation and privacy amplification protocols. 

To this point we have assumed that the transmission line between Alice and Bob is 
lossless. In practice this will not be true. If we make no constraints on Eve's technical 



abilities then we must assume that all lost light has fallen into her hands |26] . Thus we must 
calculate Eve's potential mutual information from Bob's error rate as if there was no loss, 
but we must set our error threshold quite high because the losses will drive up Bob's errors. 
It is clear that loss of 50% or more can not be tolerated because Eve's and Bob's error rates 
become equal at this point. Indeed as losses approach 50% the expenditure of resources by 
Bob and Alice needed to reconcile and privacy amplify will increase rapidly. 

Let us estimate by what factor the length of the final secure key would be reduced over 
the length of the original string sent by Alice in a system with 25% loss. Consider an original 
signal to noise of about lOdB, leading to a base error rate with 25% loss of 7.7%. Setting 
as before our maximum error rate 1.5% above the base rate at 9.3% we can bound Eve's 
error rate at >16.3%. Bob and Alice sacrifice half their data in this step. Reconciliation will 
reduce Bob and Alice's data string by a factor of 0.81 and leave Eve with an error rate >7%. 
If we require that Eve's mutual information be <0.001 for the transmission to be considered 
secure then we find a block length of n = 46 is required in the privacy amplification step. 
Thus the secure key will be reduced by a factor of 0.5 x 0.81 x 0.02 = 0.01. (A similar 
estimate for the optimum no loss case gives a reduction factor of 0.025) Data transmission 
via rf signals is a mature technology and bit transmission rates of 100 MHz would seem quite 
reasonable. Thus secure key transmission rates of a a MHz would seem practical under these 
conditions. This is about three orders of magnitude better than what is presently achievable 
with single photon schemes. On the other hand it should be noted that single quanta schemes 
can tolerate much higher losses M. 
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V. SQUEEZED STATE QUANTUM CRYPTOGRAPHY 



The preceding discussion has shown that a cryptographic scheme based on coherent light 
can produce secure keys with an efficiency of about 1/40 — > 1/100. We now consider whether 
squeezed light can offer improved efficiency. 

The set-up is shown in Fig. 5. Once again Alice encodes her number strings digitally, 
but now she impresses them on the amplitude quadratures of two, phase locked, amplitude 
squeezed beams, a and b, one on each. A tt/2 phase shift is imposed on beam b and then 
they are mixed on a 50:50 beamsplitter. The resulting output modes, c and d, are given by 




d=^ l -{a-ib) (22) 

These beams are now in an entangled state which will exhibit Einstein, Podolsky, Rosen 
(EPR) type correlations p?| , p9| . Negligible information about the signals can be extracted 
from the beams individually because the large fluctuations of the anti-squeezed quadratures 
are now mixed with the signal carrying squeezed quadratures. One of the beams, say c, 
is transmitted to Bob. The other beam, d, Alice retains and uses homodyne detection to 
measure either its amplitude or phase fluctuations, with respect to a local oscillator in phase 
with the original beams a and b. She randomly swaps which quadrature she measures, and 
stores the results. Bob, upon receiving beam c, also randomly chooses to measure either its 
amplitude or phase quadrature and stores his results. After the transmission is complete 
Alice sends the results of her measurements on beam d to Bob on an open channel. About 
half the time Alice will have measured a different quadrature to Bob in a particular time 
window. Bob discards these results. The rest of the data corresponds to times when they 
both measured the same quadratures. If they both measured the amplitude quadratures of 
each beam Bob adds them together, in which case he can obtain the power spectrum 

V + = <\(^ + c) + (d i + i)\ 2 > 

= V s , a + V+ a (23) 

where the tilde indicate Fourier transforms. Thus he obtains the data string impressed on 
beam a, V SAl imposed on the sub-QNL noise floor of beam a, V^ a . Alternatively if they 
both measured the phase quadratures of each beam, Bob subtracts them, in which case he 
can obtain the power spectrum 

V~ = <\{& -c) - $ - 3)\ 2 > 

= K,6 + V+ b (24) 

i.e. he obtains the data string impressed on beam b, V S) b, imposed on the sub-QNL noise 
floor of beam b, V^ b . Thus the signals lie on conjugate quadratures but both have sub-QNL 



noise floors. This is the hallmark of the EPR correlation ||30|| . As for the coherent state case 
Alice and Bob now compare some sub-set of their shared data and check for errors. If the 
error rate is sufficiently low they deem their transmission secure and use reconciliation and 
privacy amplification on the undisclosed sub-set of their data to produce a secure key. 
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Consider now eavesdropper strategies. Eve must intercept beam c if she is to extract any 
useful information about the signals from the classical channel (containing Alice's measure- 
ments of beam d) sent later. She can adopt the guessing strategy by detecting a particular 
quadrature of beam c and then using a similar apparatus to Alice's to re-send the beam and 
a corresponding classical channel later. As before she will only guess correctly what Bob will 
measure half the time thus introducing a BER of 25%. Instead she may try simultaneous 
detection of both quadratures of beam c. As in the coherent case the noise she introduces 
into her own measurement (V B ) and that she introduces into Bob's (Vg) are in general 
limited according to Eqs.[|[rU] and [IT]. However now the consequences of these noise limits 
on the signal to noise transfers that Eve and Bob can obtain behave quite differently because 
the signals they are trying to extract lie on sub-QNL backgrounds. The maximum signal 
transfer coefficients that Eve can extract are given by 
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To achieve maximum security we require that the anti-squeezed quadratures of the beams 
have large excess noise. This could easily be arranged experimentally. The maximum signal 
transfer coefficients (Eq.|23| and Eq.pB|) then reduce to 

n 



T E = 77+ - (27) 



and similarly Bob's are 
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For the squeezed noise floors the same (V+ a = V^ b = V n ) we find the signal transfers are 
restricted via 

4K 2 (^-1)(^-1)>1 (29) 

E E 



n 



1 E 1 B 



I) > 1 



(30) 



4K 2 (-^-l)(-^-l)>l (31) 

B E 

It is straightforward to show that a symmetric attack on both quadratures is Eve's best 
strategy as it leads to a minimum disturbance in both her and Bob's measurements. Using 
this symmetry to simplify Eq.|29] leads to the following general restriction on the signal 
transfer Eve can obtain: 

n < ^ (32) 

Once the squeezing exceeds 3 dB (V n = 0.5) the signal to noise that Eve can obtain simul- 
taneously is reduced below that for the coherent state scheme. In the limit of very strong 
squeezing (V n — > 0) Eve can extract virtually no information simultaneously. Similarly Bob's 
signal transfer is restricted according to: 

a-J?-^ 4 ^ (33) 

If squeezing is strong then almost any level of interception by Eve will result in very poor 
signal transfer to Bob. In Fig. 6 we show plots of error rates of Bob versus minimum error 
rates of Eve for various levels of squeezing. In comparison with the coherent scheme (Fig. 3) it 
can be seen that larger disturbances are caused in Bob's information for the same quality of 
Eve's interception. As a numerical example consider the specific encoding scheme of section 
I and suppose the squeezing is 10 dB (V n = 0.1). Assuming no loss and using the same 
assumptions as those used to evaluate the coherent scheme in the last section we find that a 
secure key of length 0.07 times the original data string length can be generated. That is an 
efficiency of about 1/14, to be compared to the coherent case of 1/40, a clear improvement. 

Unfortunately this high sensitivity to interception by Eve also results in a high sensitivity 
to loss. For the case above the break even point between Bob and Eve's errors is for a loss of 
only 16%. The squeezing system can only be used to advantage if the loss in the transmission 
is much less than this value. Thus we find that although in principle squeezing improves 
the efficiency of the scheme, in practice the constraints on the quality of the transmission 
become quite critical. 



VI. TELEPORTATION AS THE OPTIMUM EAVESDROPPER STRATEGY 

It is interesting to consider what physical techniques Eve could use to realize the optimal 
attack strategy we have assumed her capable of throughout this discussion. Firstly she 
would need to replace the lossy transmission line that Bob and Alice are using with her own 
transmission line of negligible loss. Given that Bob and Alice will presumably employ the 
most efficient transmission line they can obtain, Eve's job is not trivial. Secondly she must 
extract information from the transmission with the least possible disturbance, such that the 
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inequalities of Eqs.|9|,[T0] and |TT| are saturated. In Ref. it was shown that Eve can use 



continuous variable teleportation |p2| , p3 l p9i as such an optimum eavesdropper strategy. In 
this section we will review that result. 

Quantum teleportation uses shared entanglement to convert quantum information into 
classical information and then back again (see Fig. 6). In particular continuous variable 
teleportation uses 2-mode squeezed light as its entanglement resource. In the limit of very 
strong squeezing no information about the teleported system can be extracted from the 
classical channel but a perfect reproduction of the quantum system can be retrieved. On the 
other hand with lower levels of squeezing some information about the system can be obtained 
from the the classical channel but at the expense of a less than perfect reproduction. We show 
in the following that under particular operating conditions the disturbance in the teleported 
state is precisely the minimum required by the generalized uncertainty principle, given the 
quality of information that can be extracted from the classical channel. Teleportation thus 
constitutes an optimum eavesdropper strategy. 

Eve's strategy would be to send the field she intercepts from Alice through a teleporter, 
adjusted such that she can read some information out of the classical channel, but still 
reconstruct the field sufficiently well such that Bob and Alice don't see a large error rate. 



The classical channel of a lossless continuous variable teleporter can be written 



F c = K(f m +]t) 

= K{f in + VGv\ + VG^lv 2 ) (34) 

where /j n is the annihilation operator of the input to the teleporter and j± = \fGv\ + 
y/G — lv\ is the annihilation operator for one of the entangled beams. The Vi are the vac- 
uum mode inputs to the squeezers, G is the parametric gain of the squeezers and K » 1 
is the measurement amplification factor. Being a classical channel simultaneous measure- 
ments of both quadratures can be made without additional penalty thus immediately Eve's 
measurement penalty is 

Vi = 2G - 1 (35) 

For no squeezing (G = 1) V# = 1, the minimum possible for simultaneous detection of both 
quadratures (see Eq.|9|). For large squeezing (G >> 1) V% become very large and Eve can 
obtain little information from the classical channel. 
The output of the teleporter is given by 

font = A/i n + A — 32 

= \f m + (XVG - VG^T)v\ + {VG- \VG^T)v 2 (36) 

where A is the gain of the teleporter and j 2 = VGv 2 + VG — lv{ is the annihilation operator 
for the other entangled beam. Thus Bob's measurement penalty for ideal measurements of 
either of the quadratures is 

T/± _ (xVg - Vg^T) 2 + (Vg- \Vg=T) 2 



If Eve operates the teleporter with gain [34| 
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A, 



■opt 




(38) 



where V sq = (y/G — y/G — l) 2 , then Bob's noise penalty is 




1 



(39) 



2G-1 



and so Eve causes the minimum allowable disturbance, i.e. V^Vg = 1. 



VII. CONCLUSION 



In this chapter we have investigated continuous variable quantum cryptography as it 
could be realized in optics by analysing the security and efficiency of specific implementations 
of two systems based on coherent and squeezed state light respectively. An Eve employing 
an optimal eavesdropper attack is assumed throughout. A possible optimal attack strategy 
that Eve could employ is outlined. 

We find that the coherent scheme can be made secure, but is not very efficient. None- 
the-less, given the maturity of optical communication technology based on rf modulation, 
this system may be competitive with discrete schemes in a local network scenario. 

The squeezed state scheme can also be made secure and in principle is more efficient 
than the coherent state system. However its greater sensitivity to losses could make it less 
practical. 

We have looked at simple protocols throughout this analysis. It could be expected that 
more sophisticated encoding, reconciliation and privacy amplification techniques would lead 
to significant improvements in performance. 
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FIGURES 



FIG. 1. Schematic of general set-up. Alice sends information encoded in the amplitude (V^) 
and phase (V^) spectra. Bob makes measurements of either the amplitude or phase quadrature. 
Some additional noise is present on his measurements, Vg. Eve does not know which quadrature 
Bob will measure thus she needs to be able to extract information about both quadratures from 
her intercepted material. This leads to strict bound on the allowed values of the additional noise 
which must appear on her measurements (V^) 

FIG. 2. Schematic of coherent light cryptographic set-up. AM is an amplitude modulator 
whilst PM is a phase modulator. 

FIG. 3. Minimum allowable error probabilities in the data of Bob and Eve are plotted for two 
signal to noise levels of Alice's beam. Trace (a) is for a signal to noise of 13dB whilst trace (b) is 
for a signal to noise of lOdB. 

FIG. 4. Decay of Eve mutual information as a function of the block length, n, in Alice and 
Bob's privacy amplification protocol is plotted for two signal to noise levels of Alice's beam. Trace 
(a) is for a signal to noise of 13dB whilst trace (b) is for a signal to noise of lOdB. The solid traces 
are exponential fits. 

FIG. 5. Schematic of squeezed light cryptographic set-up. Sqza and sqzb are phase locked 
squeezed light sources. Rna and Rnb are independent random number sources. Bs and pbs are 
non-polarizing and polarizing beamsplitters respectively. Half-wave plates to rotate the polariza- 
tions are indicated by A/2 and optical amplification by A. The tt/2 phase shift is also indicated. 
HD stands for homodyne detection system. 

FIG. 6. Minimum allowable error probabilities in the data of Bob and Eve are plotted for 
various levels of squeezing. 

FIG. 7. Schematic of teleportation being used as an optimum eavesdropper strategy. 
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